Virtual noiseless amplification and Gaussian post-selection 
in continuous- variable quantum key distribution 
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The noiseless amplification or attenuation are two heralded filtering operations that enable re- 
spectively to increase or decrease the mean field of any quantum state of light with no added noise, 
at the cost of a small success probability. We show that inserting such noiseless operations in a 
transmission line improves the performance of continuous-variable quantum key distribution over 
this line. Remarkably, these noiseless operations do not need to be physically implemented but 
can simply be simulated in the data post-processing stage. Hence, virtual noiseless amplification 
or attenuation amounts to perform a Gaussian post-selection, which enhances the secure range or 
tolerable excess noise while keeping the benefits of Gaussian security proofs. 
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Continuous-variable quantum key distribution (CV 
QKD) based on Gaussian states and homodyne or het- 
erodyne detection can achieve very high secret key rates, 
see e.g. [l| for a review. Moreover, its practical imple- 
mentation does not require single-photon detectors and 
the system can be made compatible with telecom optical 
networks 0. However, although theory predicts that a 
secure key can be generated for a pure loss channel over 
an arbitrary large distance [|| , the practical range of CV 
QKD is currently limited to several tens of kilometers by 
noise and imperfect classical data processing [H, [f| . 

In contrast to classical optical networks, losses in quan- 
tum communication channels cannot be compensated by 
usual phase-insensitive amplifiers as the latter inevitably 
add noise @, making the channel insecure. Recently, 
however, the concept of heralded noiseless quantum am- 
plification has emerged as a novel tool Q , which enables 
one to probabilistically increase the amplitude of a coher- 
ent state without adding any extra noise, \a) — > \ga) with 
gain g > 1. Of course, a natural question arises whether 
this noiseless amplifier may improve the performance of 
QKD, especially enhance its secure range. In ref. Q, it 
was indeed argued that (a double version of) the noiseless 
amplifier can be beneficial for device- independent quan- 
tum cryptography with single photons. 

Here, we investigate this question in more general 
terms. We start from the observation that any phys- 
ical realization of the noiseless amplifier turns out to 
be very demanding. Even the proof-of-principle exper- 
imental noiseless amplification of weak coherent states 
requires state-of-the art technology, such as single-photon 
addition and subtraction, or an auxiliary source of sin- 
gle photons and multiphoton interference [t^-[l3j]. More- 
over, the actual success rate of these experiments is much 
lower than the theoretical predictions due to various ex- 
perimental limitations, and the transformation can fur- 
thermore only be implemented approximately. Such an 
approach seems rather impractical in the context of CV 
QKD where the system should be reasonably simple and 
robust to allow for field deployment. 



In this paper, we show that the physical implemen- 
tation of the noiseless amplifier can be substituted with 
a suitable data processing, so that the amplification is 
performed only virtually. Just like virtual entanglement 
is used to analyze the security of prepare-and-measure 
protocols 14], it appears that virtual noiseless amplifica- 
tion may simulate the associated quantum filter and be 
beneficial to CV QKD. We also turn our attention to a 
dual quantum filter called noiseless attenuation, which is 
analogous to noiseless amplification but with a gain lower 
than one [l5| . It probabilistically transforms \a) —> \va) 
with gain v < 1, so it is akin to a beam splitter but it 
effects the same decrease of the mean amplitude for any 
state with no noise. Noiseless attenuation can also be 
faithfully emulated by classical postprocessing of the ex- 
perimental data with a reasonable overhead (as we shall 
see, noiseless amplification can in principle be emulated 
arbitrarily well, but an exact emulation is in contrast 
only possible in the limit of a low success probability due 
to heavy rejection). 

We shall demonstrate that virtual noiseless amplifica- 
tion or attenuation can extend the range of CV QKD over 
noisy channels. A simple picture, which provides a good 
intuition of this effect though it is not rigorous, is as fol- 
lows. The emitter (Alice) preprocesses her signal states 
by noiselessly attenuating them, thereby making them 
strongly indistinguishable to an eavesdropper (Eve). At 
the other end of the line, the receiver (Bob) revives the 
signal states by noiselessly amplifying them. Since the 
two quantum filters are Gaussian (trace-decreasing) op- 
erations, the pre- and post-selected data appear as if they 
emerged from a deterministic Gaussian protocol; hence, 
the security pro ofs based on the optimality of Gaussian 
attacks hold [I6l4l8j . Somehow, Eve cannot bias the pre- 
and post-selection filters, and the above "compaction" of 
the signal states in the channel can only be detrimental 
to her. In practice, the pre-selection is not needed (it 
amounts to reducing the modulation variance) , while the 
post-selection associated with noiseless amplification can 
be applied virtually on the experimental data. 
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FIG. 1: (a) Prepare-and-measure CV QKD protocol with co- 
herent states and heterodyne detection, (b) Equivalent vir- 
tual entanglement-based protocol, with heterodyne detection 
on both sides. 



FIG. 2: (a) CV QKD with coherent states and heterodyne de- 
tection augmented with noiseless amplification of the received 
signal, (b) Equivalent protocol where noiseless amplification 
is emulated by post-processing Bob's measurement data. 



CV QKD protocols. — Gaussian protocols, to which 
we restrict here, are based on the Gaussian modula- 
tion of Gaussian (coherent or squeezed) states of light 
and Gaussian (homodyne or heterodyne) measurements, 
which gives four possibilities. In the first two protocols, 
Bob performs homodyne detection, measuring at random 
the x or p quadrature, while Alice emits a Gaussian- 
modulated coherent or squeezed [2(| state. In the 
next two, Bob performs heterodyne detection, measur- 
ing the x and p quadratures simultaneously, while Al- 
ice emits again a coherent 21] or squeezed [22j state. 
Note the existence of a fifth protocol, where Alice sends 
(mixed) thermal states instead of pure states [23| . 

In what follows, we focus on the most symmetric pro- 
tocol [21], where Alice emits coherent states \a) and 
Bob projects onto coherent states \j3) (heterodyne de- 
tection), as illustrated in Fig. 1(a). Alice draws a com- 
plex amplitude a from a bivariate Gaussian distribution 
of variance V, and sends \a) to Bob through a quan- 
tum channel C which is controlled by Eve. Then, Bob 
makes a projective measurement onto coherent states and 
obtains the outcome j3. After N repetitions of these 
steps, Alice and Bob extract a secret key from the ac- 
cumulated classical data. From Eve's point of view, this 
prepare-and-measure protocol is indistinguishable from 
an entanglement-based scheme where Alice prepares an 
entangled two-mode squeezed vacuum state 

oo 

|*EPR> = Vl- A 2 (1) 

with A 2 = 2V/(2V + 1), and performs heterodyne mea- 
surement on one mode, see Fig. 1(b). 

This virtual entanglement picture [3] is very useful 
for analyzing the security and understanding the benefit 
of noiseless amplification. Suppose that £ is a pure loss 



channel with transmittance T. As shown in ref. |24j . 
an entangled state ([1]) can be faithfully distributed over 
C if Alice sends one mode of a weakly entangled state 
(A <C 1) to Bob, who noiselessly amplifies his mode. In 
the considered CV QKD protocol, this would correspond 
to weak modulation on Alice's side (V < 1) combined 
with noiseless amplification on Bob's side, see Fig. 2(a). 

Virtual noiseless amplification. — The noiseless ampli- 
fier is described by the non- unitary operator g n , where 
n denotes the photon number operator. Although it is 
probabilistic, this filter is Gaussian in the sense that it 
converts a Gaussian state between Alice and Bob in the 
virtual entanglement picture into another Gaussian state. 
Forgetting about the modulation variance V, this can be 
viewed as effectively converting the Gaussian channel C 
into another Gaussian channel with presumably higher 
associated performances. Moreover, we can recycle all 
security proofs and corresponding secret key rates that 
have be obtained using the Gaussian formalism [l6l - [T8j . 

Unfortunately, g n is an unbounded operator for g > 1 , 
so it cannot be implemented exactly, and, furthermore, 
its optical implementation is very challenging. Remark- 
ably, these obstacles can be overcome by emulating the 
noiseless amplifier, which is possible as it is immediately 
followed by heterodyne measurement. Note that we can 
consider the noiseless amplifier g n at the output of chan- 
nel C to be part of the detection process, see Fig. 2(a). 
Denoting by p the mixed state at the output of C, Bob 
obtains (after amplification) the measurement outcome 
ft with relative probability 

PM = - (P\9*P9*\P)- ( 2 ) 
Using the identity g n \f3) = e^ 2_1 ^' 3 l 2 / 2 |g/3), we can write 

P B (J3) = -e<f- 1 '>M'{gl3\p\9P)- (3) 
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If Bob directly measures p without prior amplification, he 
gets the outcome 7 with probability P{j) = — (tIpIt)- By 
comparing this probability with Eq. (|3]), we conclude that 
Bob can emulate the noiseless amplificater by properly 
rescaling each measurement outcome 7 as (3 = "f/g, while 
assigning to it a relative weight Q(j) = e^ 1 ^ 9 )l 7 , see 
Fig. 2(b). 

This relative weight can be simulated by post-selection, 
accepting each data 7 with a probability P aC c(7) that is 
proportional to Q("f). A difficulty arises here because 
(5(7) diverges for large I7I, which translates the impos- 
sibility of implementing a perfect noiseless amplifier. If 
Alice's modulation V is weak enough, P(j) could be suf- 
ficiently narrow so that lim^i^oo P("i)Q(pi) = 0. Then, 
for a finite number N of data points jj, one can accept 
each one with probability 
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-Pace (7) = e 



(1- 



7Af| 2 ) < I 



(4) 



where 



7m I 



maxj \ As derived in the Appendix, 
the number of accepted data points -/Va CC grows sublin- 
early with the size N, so unfortunately the rejection rate 
increases with TV and the procedure becomes rather inef- 
ficient. Alternatively, one can fix \ jm\ independently of 
N. For instance, if P{^)Q{^) is expected to exhibit a dis- 
tribution with variance V 7 , then one can choose |7m| as 
a multiple of \JV^ (say, 10 standard deviations) and set 
Pace (7) = 1 if M > I 7m |- Assuming a Gaussian distribu- 
tion of variance Vg for Bob's measurement outcomes 7, 
we show in the Appendix that ./V acc scales linearly with 
N in this case, namely 
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N 



g 2 + 2V B (l-g 2 ) [ 



(5) 

Note that this only works if 2Vb < g 2 /(g 2 — 1)- Given 
its linear scaling, this second method is more practical 
than the first one although the data processing does not 
emulate the exact Gaussian filter because of the finite 
cut-off, which might complicate the security analysis. 

Virtual noiseless attenuation. — In view of these diffi- 
culties, we also consider a reverse situation where the 
noiseless amplifier is on Alice's side (replaced, in fact, 
by a larger V) while the noiseless attenuator is on Bob's 
side (replaced by its virtualization). The noiseless at- 
tenuation v n with v < 1 is a physical operation, which 
can be implemented by sending the state through a beam 
splitter of transmittance v 2 and projecting the auxiliary 
output port of the beam splitter onto vacuum. Although 
the efficiency of common single-photon detectors is too 
low to implement this latter projection with high fidelity, 
one can faithfully emulate noiseless attenuation with an 
acceptable overhead. The principle is the same as before. 
Denoting by p the state emerging from C, the relative 
probability of the measurement outcome /3 after attenu- 
ation can be expressed as 



P v {0) = ±<J3\v*pv* 

7T 



1 



(vflpWP)- (6) 
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FIG. 3: CV QKD over an amplifying channel with gain G and 
excess thermal noise n t h- The maximum allowed noise n t h,max 
decreases for increasing G. A secret key can be generated 
if n t h < «th, max, shown with the blue solid line (standard 
protocol) or red dashed line (protocol augmented with virtual 
noiseless attenuation). The grey area indicates the class of 
channels for which no key can be generated without virtual 
noiseless attenuation. We optimize over Alice's modulation 
variance V and Bob's attenuation v, and assume n = 0.9. 



Since v < 1, we have e - '- 1-1 ' - 1 '' 3 ' < 1, hence no diver- 
gence problem. Therefore, we can emulate noiseless at- 
tenuation by rescaling the measurement outcome 7 as 
/3 = 7/1/ and accepting the data point with probability 



Qii) 



-l)l7f 



< 1. In this way, we post-select a 



subset of the original data that corresponds to a protocol 
where the signal would be noiselessly attenuated before 
heterodyne detection. As illustrated in the Appendix, 
this emulation is efficient in the sense that the number of 
accepted data points is proportional to the original size, 



N 



2Vs(l 



(7) 



The noiseless attenuation is a trace-decreasing Gaus- 
sian completely-positive map, so it preserves the Gaus- 
sian form of the entangled state between Alice and Bob. 
Therefore, the security results on deterministic CV QKD 
protocols with Gaussian modulated coherent states can 
be applied to this protocol with virtual noiseless attenu- 
ation inserted on Bob's side (without the heavy-rejection 
problem of virtual noiseless amplification). 

CV QKD with Gaussian post- selection. — Exploiting 
that the (Gaussian) quantum filter effected by the noise- 
less amplifier or attenuator can be emulated during the 
post-processing stage, we now investigate the benefit of 
the resulting Gaussian post-selection for CV QKD. As an 
instructive example, we first consider virtual noiseless at- 
tenuation at the output of a Gaussian amplifying channel 
with excess noise [25|], see Fig. 3. In the Heisenberg pic- 
ture, this channel is described by a linear transformation 
of the annihilation and creation operators, 



flout 



= VGa in + VG^T, 



it 



(8) 



where a and c denote the annihilation operators of the 
signal and ancilla modes, respectively, and G is the chan- 
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FIG. 4: CV QKD over a lossy channel with transmittance 
T and excess thermal noise n t h- The maximum allowed noise 
Hth.max decreases for decreasing T. A secret key can be gener- 
ated if nth < "-th.max, shown with the blue solid line (standard 
protocol) or red dashed line (protocol augmented with virtual 
noiseless amplification). The grey area indicates the class of 
channels for which no key can be generated without virtual 
noiseless amplification. We optimize over Alice's modulation 
variance V and Bob's amplification g, and assume n = 0.9. 

nel gain. This channel is not quantum-noise limited, 
which is modeled by assuming that the ancilla mode 
is initially prepared in a thermal state with mean pho- 
ton number (c)c) = n t h/(G — 1), where nth is the mean 
number of excess thermal photons injected into the sig- 
nal mode. Sending one part of the entangled state ([1]) 
through this channel yields a mixed two-mode Gaussian 
state with covariance matrix 

/ a I ca z \ , . 

^ AB= {ca z bl )' ® 

where a — cosh(2r), b — Gcosh(2r) + G — 1 + 2n t h, 
c = \/Gsinh(2r), and r — tanb~ (A). Here, I stands 
for the 2x2 identity matrix and a z stands for the third 
Pauli matrix. The covariance matrix of the Gaussian 
state obtained conditionally on the success of v n (or g n ) 
can be conveniently calculated by exploring a connection 
between covariance matrix elements and density matrix 
elements in Fock basis [26[ , see Appendix. The secret key 
rate against collective attacks is calculated according to 

K = ma,x(r/I AB - \ae, tjIab - Xbe), (10) 

where the first (second) term corresponds to direct (re- 
verse) reconciliation, so we choose the protocol that 
yields the higher secret key rate (n is the reconciliation 
efficiency). Here, Iab is Shannon mutual information 
between Alice and Bob, while \ae (xbe) is the Holevo 
quantity between Alice and Eve (Bob and Eve). All these 
quantities can be calculated using standard methods (see 
Appendix) since we know the post-selected virtual Gaus- 
sian entangled state shared by Alice and Bob. In Fig. 3, 
we show the dependence of the maximum allowed ther- 
mal noise nth, max on the channel gain G. It appears that 
for sufficiently high G, the inclusion of virtual noiseless 



attenuation is advantageous as a secret key can be gen- 
erated for a higher level of thermal noise. 

We have also performed similar calculations for a lossy 
channel with transmittance T and excess noise n t h, see 
Appendix. Unexpectedly, noiseless attenuation also helps 
here if T is not too small, although the effect is tiny. We 
do not plot it here as the effect is similar but much more 
pronounced by inserting noiseless amplification instead 
of attenuation on Bob's side. As shown in Fig. 4, the 
protocol tolerates more thermal noise nth for a fixed T 
when it is augmented with virtual noiseless amplification. 
Note that we have neglected the slight non-Gaussianity 
induced by the post-selection cutoff when calculating the 
secret key rates. We have also assumed a realistic value 
r\ = 0.9 for the efficiency of the classical data reconcil- 
iation 0, H| • The advantage of virtual noiseless ampli- 
fication would be even stronger for r\ — > 1, but this is 
a rather unrealistic limit as error correction is a highly 
challenging task in practical CV QKD 2] . 

Conclusion. — We have demonstrated the improved 
performance (enhanced secure range or tolerable excess 
noise) of a CV QKD protocol with coherent states, het- 
erodyne detection, and virtual noiseless amplification or 
attenuation. The latter quantum filters do not need to 
be physically implemented, which would be experimen- 
tally quite challenging, but may be simulated by classi- 
cal post-processing (Gaussian post-selection) of the mea- 
sured data, making this proposal immediately applica- 
ble. Furthermore, since the above quantum filters are 
Gaussian, the post-selected data can be treated as emerg- 
ing from an effective Gaussian protocol and the security 
proofs based on Gaussian extremality still hold. 

One may also consider virtual operations in protocols 
where Bob performs homodyne detection. A noiseless at- 
tenuation followed by the projection onto squeezed dis- 
placed states can be interpreted as a projection onto 
squeezed displaced state with lower squeezing and re- 
scaled displacements. Thus, to simulate noiseless atten- 
uation, we would need to change the detection scheme so 
that it performs projections onto finitely squeezed states. 
This could be achieved by employing an eight-port ho- 
modyne detection with unbalanced central beam splitter, 
such that the amplitude and phase quadratures of the 
state are measured with different precision. In view of 
all this, we anticipate that Gaussian post-selection could 
be a tool of practical importance in CV QKD. 

Note: In the course of completion of this work, the 
importance of noiseless amplification in CV QKD has 
been independently demonstrated in (2lJ and [28j . 
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Appendix 



bounded by 



Gaussian post-selection equivalent to the 
noiseless amplification 



The heralded noiseless amplifier corresponds to an (un- 
bounded) filtration operator g n in Fock space. If it is im- 
mediately followed by heterodyne measurement, we have 
shown that it can be replaced by an appropriate post- 
processing of the measured data. One must rescale each 
measurement outcome 7 as /3 = j/g and assign a rela- 
tive weight Q(7) = e^ 1-9 )' 7 to it. The unbounded- 
ness of the quantum filter translates into the fact that 
(5(7) diverges for large I7I, which makes it difficult to 
devise a good post-selection procedure. A first possi- 
bility is to accept each data point 7 with probability 



face (7) 



< 1, where \jm\ is the 



maximum value of I7I of the set of size N. Then, nu- 
merical simulations suggest that assuming Gaussian dis- 
tribution for Bob's measurement outcomes 



N 



P(7)^acc(7)l7|d|7| 



(A.2) 



where 7 = |7|e lc ^. For Gaussian distribution (|A.1[) one 
recovers a linear scaling of output data points with N, 



N 



> 



9 



g? + 2V B (l-gi) 



-(1-3~ 2 )|7m| 2 



The integral converges and the emulation is possible only 
if2(<7 2 — 1)Vb < g 2 ■ The emulation of the noiseless ampli- 
fication is much more practical with this second method, 
but we have to keep in mind that it does not exactly em- 
ulate the target Gaussian filtration as the cutoff \jm\ is 
finite, which might complicate the security analysis. 



Gaussian post-selection equivalent to the 
noiseless attenuation 



P(7) = ^e-^, (Al) 

the number of accepted data points iV acc grows with N . 
However, the scaling is only sublinear, A acc = N K where 
k < 1, see Fig. 5. This implies liniAr^oo N acc /N = and 
the procedure becomes inefficient for large N. 

A second possibility is to choose a large fixed value for 
|7Af| and set -P acc (7) = 1 if M > \im\- The number of 
data points A acc preserved after filtering is then lower 



6 1 1 3.0 




01234567 01234567 
logio(N) log'io(N) 

FIG. 5: Virtual noiseless amplification, (a) Dependence of 
Bob's maximum measurement outcome |tm| on the number 
of measurements N. (b) Number of measurement outcomes 
iV acc preserved after filtration is plotted as a function of N. 
This latter dependence can be approximately described by 
a power law iV acc oc N K with ft ~ 0.38. The graphs were 
obtained assuming Vb = 1 and g 2 = 1.5 and the curves repre- 
sent averages over 100 independent simulations of the filtering 
procedure. 



The idea of replacing the actual noiseless amplifier by 
some appropriate data post-processing can be applied to 
the noiseless attenuator too. This amounts to rescaling 
the measurement outcome 7 as f3 = j/u and accepting 
the data point with probability Q{j) = e~^ v 2_1 )H , 
The main difference is that there is no divergence prob- 
lem here since Q{j) < 1. Therefore, the emulation is effi- 
cient in the sense that the number of accepted data points 
is proportional to the original number of data points, 

at r 27T f°° 

^T = l I P(7K ( ^ 2 - 1)l7|2 |7|d|7|d0. 

In particular, for Gaussian distribution of Bob's out- 
comes (|A.1[) we obtain 



N v 2 + 2V B (1 - v 2 )' 



3. Evaluation of the covariance matrices 

Elements of covariance matrix jab of a two-mode state 
Pab are defined as jAB,jk = (ARjARk + AR k ARj), 
where AR^ = Rj - (Rj), (Rj) = Tr[Rjp A B} and R = 
(xa,Pa, xb,Pb) denotes vector of quadrature operators. 
Note that variances of quadrature operators of vacuum 
state are equal to |, hence the covariance matrix of vac- 
uum is equal to the identity matrix. 

Let us now consider a CV QKD protocol where Alice 
prepares two-mode squeezed vacuum state 

00 

\*epr) = Vl - A 2 ^ n \n,n) A B, (A.3) 

n=0 
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whose covariance matrix reads 



7epr — 



Va^l 

-V^~i 



-Vc 




a 



J 



and a = (1 + A 2 )/(l — A 2 ). Alice keeps mode A for 
heterodyne measurement, while she transmits mode B 
through the noisy quantum channel C, which can be as- 
sumed Gaussian since this is the worst case (optimal col- 
lective attack). The covariance matrix changes to 



1AB 



( a c 

a -c 

c b 

\0 -c b 



(A.4) 



where 



b = Ta + 1 - T + 2n t h, c = ^fT(a 2 - 1), (A.5) 

for a lossy channel with transmittance T < 1 and excess 
thermal noise nth, while 



6 = Ga + G-l + 2n th , c= a/G( 2 - 1), (A.6) 

for an amplifying channel with gain G > 1 and excess 
thermal noise nth- 

We next determine the covariance matrix of the Gaus- 
sian state obtained by applying the quantum filter g n to 
Bob's mode. The cases g > 1 and g = v < 1 cover both 
noiseless amplification and attenuation, respectively. In- 
spired by [26|, we exploit the relationship between ele- 
ments of the covariance matrix "/ab and elements of the 
density matrix pab m Fock state basis. The Husimi Q- 
function of the two-mode state can be expressed as 



Q(R) 



Vdet Tab _ R r rAflR 



(A.7) 



where 



Tab = {iab (A.8) 
and I denotes the identity matrix. We can write 





Tab = 



(A C 

A -C 

C B 

V -C B 



(A.9) 



where A, £?, and C are functions of a, 6, c. Since the 
Husimi Q-function is a generating function of density 
matrix elements in Fock basis, one can establish a rela- 
tionship between elements of matrix Tab and normalized 
density matrix elements in Fock basis (Jjk,im = P pQ '™ 
[2t| . The action of the filter 1^ eg) g nB is particularly 
simple in Fock basis, 



g CTjkdm- 



(A.10) 



At the same time, the filtration g n is a Gaussian opera- 
tion which preserves the Gaussian shape of Wigner and 
Husimi function. After a straightforward calculation one 
finds that the matrix Tab of the Gaussian state after 
filtration reads, 



r' — 

1 AB — 



A 


o 




A 


-gc 



gc 
o 





o \ 

-gc 
o 

' g\B-\) + \) 

(ATI) 

The covariance matrix "f' A B °f ^ nc filtered state can then 
be obtained by inverting the relation (| A.8|) . 

Fab)- 1 -I- (A.12) 



lAB 



4. Evaluation of the secret key rates 

The protocol where Alice prepares coherent states and 
Bob performs heterodyne detection is formally equiva- 
lent to entanglement-based protocol where Alice prepares 
two-mode squeezed vacuum, sends one mode to Bob, and 
both Alice and Bob perform heterodyne detection. In 
this way, Alice and Bob obtain Gaussian correlated data 
whose statistics is governed by Husimi Q-function (|A.7[) 
and the mutual information between Alice and Bob is 
given by 

UB = k% fr+w+i) (A . 13) 

(a + l)(b + 1) — cr 
The Holevo quantity xae can be expressed as 

Xae = S(pab) - ^2pjS(p B ,j), (A.14) 

j 

where S(p) denotes von-Neumann entropy of quantum 
state p and pbj denotes density matrix of Bob's mode 
conditional on jth measurement outcome of Alice. Note 
that the expression ([A. 141) follows from the fact that Eve 
holds purification of the quantum state shared by Alice 
and Bob hence the entropies of Eve's states appearing in 
the original definition of xae are equal to the entropies 
of states of Alice and Bob. If Alice projects onto coherent 
states, then all states pbj are Gaussian, have the same 
covariance matrix 



IB 



a+l 

b 







a+l 



(A.15) 



and differ only in displacements. Therefore all Bob's con- 
ditional states have the same entropy Sb and we can 
write 



XAE 



~>AB 



Se 



(A.16) 



The von-Neumann entropies of Gaussian states appear- 
ing in the above formula can be calculated as follows, 



Sal 



E 



1 1 Mj 
- log 2 



1 



1 i N 
- log 2 —, 



1 



(A.17) 
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where denote symplectic eigenvalues of the covariance 
matrix 7ab, and 

Sb = ^~ log 2 — — lo S2^— . ( A - 18 ) 

where = b — c 2 /(a + 1) is the symplectic eigenvalue of 
covariance matrix 73. 



By making suitable replacements in the above formu- 
las we can straightforwardly calculate also Xbe and the 
mutual information and Holevo quantity for protocol in- 
cluding noiseless amplification or noiseless attenuation. 



